Internet-Draft V. Dolmatov, Ed.
Intended status: Informational Cryptocom Ltd.
Expires: May 10, 2010 November 10, 2009
GOST R 34.10-2001digital signature algorithmdraft-dolmatov-cryptocom-gost34102001-06
Status of This Memo
This Internet-Draft is submitted to IETF in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on May 10, 2010.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (http://trustee.ietf.org/license-info).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Abstract
This document is intended to be a source of information about the
Russian Federal standard for for electronic digital signature
generation and verification processes GOST R 34.10-2001 [GOST3410],
which is one of the official standards in the
cryptography used in Russian algorithms (GOST algorithms).
Recently, Russian cryptography started to be used in
applications intended to work with the OpenSSL
cryptographic library. Therefore, this document has been created as
information for users of Russian cryptography.
V.Dolmatov Expires May 10, 2010 [Page 1]

1.2. The purpose of GOST R 34.10-2001
GOST R 34.10-2001 describes generation and verification processes for
digital signature, based on operations with elliptic curve points
group, defined over prime finite field.
GOST R 34.10-2001 is developed to replace GOST R 34.10-94. Necessity
for this development is caused by the need to increase the digital
signature security against unauthorized modification. Digital
signature security is based on complexity of discrete logarithm
calculation in elliptic curve points group and also on the security
of the hash function used (according to [GOST3411]).
Terminologically and conceptually GOST R 34.10-2001 is in accord with
international standards ISO 2382-2 [1], ISO/ IEC 9796 [2], series
ISO/ IEC 14888 [3]-[5] and series ISO/ IEC 10118 [6]-[9].
Note: the main part of GOST R 34.10-2001 is supplemented with two
appendixes:
extra terms in digital signature area (Appendix A to this memo);
test examples (section 7 of this memo);
a bibliography in digital signature area (section 12 of this memo).
2. Applicability
GOST R 34.10-2001 defines an electronic digital signature (or simply
digital signature) scheme, digital signature generation and
verification processes for a given message (document), meant for
transmission via insecure public telecommunication channels in data
processing systems of different purposes.
Use of digital signature based on GOST R 34.10-2001 makes transmitted
messages more resistant to forgery and loss of integrity, in
comparison with digital signature scheme prescribed by the previous
standard.
GOST R 34.10-2001 is obligatory to use in Russian Federation in all
data processing systems providing public services.
3. Definitions and notations
3.1. Definitions
The following terms are used in the standard:
3.1.1 Appendix: Bit string, formed by digital signature and by
arbitrary text field (ISO/IEC 148881-1 [3]).
3.1.2 Signature key: Element of secret data, specific to the subject
V.Dolmatov Expires May 10, 2010 [Page 3]

and used only by this subject during the signature generation process
(ISO/IEC 14888-1 [3]).
3.1.3 Verification key: Element of data mathematically linked to the
signature key data element, used by the verifier during the digital
signature verification process (ISO/IEC 14888-1 [3]).
3.1.4 Domain parameter: Element of data which is common for all the
subjects of the digital signature scheme, known or accessible to all
the subjects (ISO/IEC 14888-1 [3]).
3.1.5 Signed message: A set of data elements, that consists of the
message and the appendix, which is a part of the message.
3.1.6 Pseudo-random number sequence: A sequence of numbers, which is
obtained during some arithmetic (calculation) process, used in
specific case instead of a true random number sequence (ISO 2382-2
[1]).
3.1.7 Random number sequence: A sequence of numbers none of which can
be predicted (calculated) using only the preceding numbers of the
same sequence (ISO 2382-2 [1]).
3.1.8 Verification process: A process using the signed message, the
verification key and digital signature scheme parameters as initial
data and giving the conclusion about digital signature validity or
invalidity as a result. (ISO/IEC 14888-1 [3]).
3.1.9 Signature generation process: A process using the message, the
signature key and digital signature scheme parameters as initial data
and generating the digital signature as the result (ISO/IEC 14888-1
[3]).
3.1.10 Witness: Element of data (resulting from the verification
process) which states to the verifier whether digital signature is
valid or invalid (ISO/IEC 148881-1 [3]).
3.1.11 Random number: A number chosen from the definite number set in
such a way that every number from the set can be chosen with
equal probability (ISO 2382-2 [1]).
3.1.12 Message: String of bits of a limited length (ISO/IEC 9796
[2]).
3.1.13 Hash code: String of bits that is a result of the hash
function (ISO/IEC 148881-1 [3]).
3.1.14 Hash function: The function, mapping bit strings onto bit
strings of fixed length observing the following properties:
1) it is difficult to calculate the input data, that is the
pre-image of the given function value;
2) it is difficult to find another input data that is the
pre-image of the same function value as is the given input data;
V.Dolmatov Expires May 10, 2010 [Page 4]

3) it is difficult to find a pair of different input data,
producing the same hash function value.
Note: The property 1 in the context of the digital signature area
means that it is impossible to recover the initial message using the
digital signature; property 2 means that it is difficult to find
another (falsificated) message that produces the same digital
signature as a given message; property 3 means that it is difficult
to find some pair of different messages, that both produce the same
signature.
3.1.15 [Electronic] Digital signature: String of bits obtained as a
result of signature generation process. This string has an internal
structure, depending on the specific signature generation mechanism.
Note: In GOST R 34.10-2001 terms "Digital signature" and "Electronic
sigital signature" are synonymous to save terminological succession
to native legal documents currently in force and scientific
publications.
3.2 Notations
In GOST R 34.10-2001 the following notations are used:
V256 - set of all binary vectors of length 256 bit;
V_all - set of all binary vectors of an arbitrary finite
length;
Z - set of all integers;
p - prime number, p > 3;
GF(p) - finite prime field represented by a set of integers
{0, 1, ..., p - 1};
b (mod p) - minimal nonnegative number, congruent to b modulo p;
M - user's message, M belongs to V_all;
(H1 || H2 ) - concatenation of two binary vectors;
a,b - elliptic curve coefficients;
m - points of the elliptic curve group order;
q - subgroup order of group of points of the elliptic curve;
O - zero point of the elliptic curve;
P - elliptic curve point of order q;
d - integer - a signature key;
Q - elliptic curve point - a verification key;
V.Dolmatov Expires May 10, 2010 [Page 5]

^ - the power operator;
/= - non-equality;
sqrt - square root;
zeta - digital signature for the message M.
4. GENERAL STATEMENTS
A commonly accepted digital signature scheme (model) (see 6 ISO/IEC
14888-1 [3]) consists of three processes:
- generation of a pair of keys (for signature generation and for
signature verification);
- signature generation;
- signature verification.
In GOST R 34.10-2001 a process for generating a pair of keys (for
signature and verification) is not defined. Characteristics and ways
of the process realization are defined by involved subjects, who
determine corresponding parameters by their agreement.
The digital signature mechanism is defined by realization of two main
processes (see part 7):
- signature generation (see. 6.1);
- signature verification (see. 6.2).
The digital signature is meant for authentication of the signatory of
the electronic message. Besides, the digital signature usage gives an
opportunity to provide the following properties during signed message
transmission:
- realization of control of the transmitted signed message
integrity,
- proof of the authorship of the signatory of the message,
- protection of the message against possible forgery.
A schematic representation of the signed message is shown in the
figure 1.
appendix
|
+-------------------------------+
| |
+-----------+ +------------------------+- - - +
| message M |---| digital signature zeta | text |
+-----------+ +------------------------+- - - +
Figure 1 - Signed message scheme
V.Dolmatov Expires May 10, 2010 [Page 6]

The field "digital signature" is supplemented by the field "text"
(see figure 1), that can contain for example identifiers of the
signatory of the message, and/or time label.
The digital signature scheme determined in GOST R 34.10-2001 must be
implemented using operations of elliptic curve points group, defined
over a finite prime field, and also with the use of hash function.
The cryptographic security of the digital signature scheme is based
on complexity of solving the problem of calculation the discrete
logarithm in elliptic curve points group, and also on the security of
the hash function used. The hash function calculation algorithm is
determined in [GOST3411].
The digital signature scheme parameters needed for signature
generation and verification are determined in 5.2.
GOST R 34.10-2001 does not determine the process of generating
parameters needed for digital signature scheme. Possible sets of
these parameters are defined for example in [RFC4357].
The digital signature represented as a binary vector of length 512
bit, must be calculated using definite set of rules stated in 6.1.
The digital signature of the received message is accepted or denied
in accordance with the set of rules, stated in 6.2.
5. Mathematical conventions
To define a digital signature scheme it is necessary to describe
basic mathematical objects, used in the signature generation and
verification processes. This section lays out basic mathematical
definitions and requirements for the parameters of the digital
signature scheme.
5.1 Mathematical definitions
Suppose a prime number p > 3 is given. Then an elliptic curve E,
defined over a finite prime field GF(p), is the set of number pairs
(x,y), x, y belong to Fp , satisfying the identity
y^2 = x^3 + a*x + b (mod p), (1)
where a, b belong to GF(p) and 4*a^3 + 27*b^2 is not congruent to
zero modulo p.
An invariant of the elliptic curve is the value J(E) satisfying the
equality
4*a^3
J(E) = 1728 * ------------ (mod p) (2)
4*a^3+27*b^2
V.Dolmatov Expires May 10, 2010 [Page 7]

Elliptic curve E coefficients a,b are defined in the following way
using the invariant J(E):
| a=3*k (mod p)
| J(E)
| b=2*k (mod p), where k = ----------- (mod p), J(E) /= 0 or 1728 (3)
1728 - J(E)
The pairs (x,y) satisfying the identity (1) are called the elliptic
curve E points, x and y are called x- and y-coordinates of the point
correspondingly.
We will denote elliptic curve points as Q(x,y) or just Q. Two
elliptic curve points are equal if their x- and y-coordinates are
equal.
On the set of all elliptic curve E points we will define the addition
operation, denoted by "+". For two arbitrary elliptic curve E points
Q1 (x1, y1) and Q2 (x2, y2) we will consider several variants.
Suppose coordinates of points Q1 and Q2 satisfy the condition x1 /=
x2. In this case their sum is defined as a point Q3 (x3,y3) with
coordinates defined by congruences
| x3=lambda^2-x1-x2 (mod p), y1-y2
| where lambda= ------- (mod p). (4)
| y3=lambda*(x1-x3)-y1 (mod p), x1-x2
If x1 = x2 and y1 = y2 /= 0, then we will define point Q3
coordinates in a following way
| x3=lambda^2-x1*2 (mod p), 3*x1^2+a
| where lambda= --------- (mod p) (5)
| y3=lambda*(x1-x3)-y1 (mod p), y1*2
If x1 = x2 and y1 = - y2 (mod p), then the sum of points Q1 and Q2
is called a zero point O, without determination of its x- and
y-coordinates. In this case point Q2 is called a negative of point
Q1. For the zero point the equalities hold
O+Q=Q+O=Q, (6)
V.Dolmatov Expires May 10, 2010 [Page 8]

where Q is an arbitrary point of elliptic curve E.
A set of all points of elliptic curve E including zero point forms a
finite abelian (commutative) group of order m regarding introduced
addition operation. For m the following unequalities hold:
p + 1 - 2*sqrt(p) =< m =< p + 1 + 2*sqrt(p). (7)
The point Q is called a point of multiplicity k, or just a multiple
point of the elliptic curve E, if for some point P the following
equality holds:
Q = P + ... + P = k*P. (8)
-----+-----
k
5.2 Digital signature parameters
The digital signature parameters are:
- prime number p is an elliptic curve modulus, satisfying the
inequality p > 2^255. The upper bound for this number must be
determined for specific realization of digital signature scheme;
- elliptic curve E, defined by its invariant J(E) or by
coefficients a, b belonging to GF(p).
- integer m is an elliptic curve E points group order;
- prime number q is an order of a cyclic subgroup of the elliptic
curve E points group, which satisfies the following conditions:
| m = nq, n belongs to Z , n>=1
| ; (9)
| 2^254 < q < 2^256
- point P /= O of an elliptic curve E, with coordinates (x_p, y_p),
satisfying the equality q*P=O.
- hash function h(.):V_all -> V256, which maps the messages
represented as binary vectors of arbitrary finite length onto
binary vectors of length 256 bit. The hash function is determined
in [GOST3411].
Every user of the digital signature scheme must have its personal
keys:
- signature key, which is an integer d, satisfying the inequality
0 < d < q;
- verification key, which is an elliptic curve point Q with
coordinates (x_q, y_q), satisfying the equality d*P=Q.
V.Dolmatov Expires May 10, 2010 [Page 9]

The previously introduced digital signature parameters must satisfy
the following requirements:
- it is necessary that the condition p^t/= 1 (mod q ) holds for
all integers t = 1, 2, ... B where B satisfies the inequality
B >= 31;
- it is necessary that the inequality m /= p holds;
- the curve invariant must satisfy the condition J(E) /= 0, 1728.
5.3 Binary vectors
To determine the digital signature generation and verification
processes it is necessary to map the set of integers onto the set of
binary vectors of length 256 bit.
Consider the following binary vector of length 256 bit where
low-order bits are placed on the right, and high-order ones are
placed on the left
H = (alpha[255], ... , alpha[0]), H belongs to V256 (10)
where alpha[i], i = 0, ... , 255 are equal to 1 or to 0. We will say
that the number alpha belonging to Z is mapped onto the binary vector
h, if the equality holds
alpha = alpha[0]*2^0 + alpha[1]*2^1 + ... + alpha[255]*2^255. (11)
For two binary vectors H1 and H2 , which correspond to integers alpha
and beta, we define a concatenation (union) operation in the
following way. Let
H1 = (alpha[255], ... , alpha[0]),
(12)
H2 = (beta[255], ..., beta[0]),
then their union is
H1||H2 = (alpha[255], ... , alpha[0], beta[255], ..., beta[0])
(13)
that is a binary vector of length 512 bit, consisting of coefficients
of the vectors H1 and H2.
On the other hand, the introduced formulae define a way to divide a
binary vector H of length 512 bit into two binary vectors of length
256 bit, where H is the concatenation of the two.
6. Main processes
In this section the digital signature generation and verification
processes of user's message are defined.
V.Dolmatov Expires May 10, 2010 [Page 10]

For the realization of the processes it is necessary, that all users
know the digital signature scheme parameters, which satisfy the
requirements of section 5.2.
Besides, every user must have the signature key d and the
verification key Q(x[q], y[q]) , which also must satisfy the
requirements of section 5.2.
6.1 Digital signature generation process
It is necessary to perform the following actions (steps) according to
Algorithm I to obtain the digital signature for the message M
belonging to V_all:
Step 1 - calculate the message hash code M: H = h(M). (14)
Step 2 - calculate an integer alpha, binary representation of which
is the vector H , and determine e = alpha (mod q ) . (15)
If e = 0, then assign e = 1.
Step 3 - generate a random (pseudorandom) integer k, satisfying the
inequality
0 < k < q. (16)
Step 4 - calculate the elliptic curve point C = k*P and determine
r = x_C (mod q), (17)
where x_C is x-coordinate of the point C. If r = 0, return to step 3.
Step 5 - calculate the value
s = (r*d + k*e) (mod q). (18)
If s = 0, return to step 3.
Step 6 - calculate the binary vectors R and S , corresponding to r
and s, and determine the digital signature zeta = (R || S) as
concatenation of these two binary vectors.
The initial data of this process are the signature key d and the
message M to be signed. The output result is the digital signature
zeta.
6.2 Digital signature verification
To verify digital signature for the received message M belonging to
V_all it is necessary to perform the following actions (steps)
according to Algorithm II:
V.Dolmatov Expires May 10, 2010 [Page 11]

Step 1 - calculate the integers r and s using the received signature
zeta. If the inequalities 0 < r < q, 0 < s < q hold, go to the next
step. In the other case the signature is invalid.
Step 2 - calculate the hash code of the received message M
H = h(M). (19)
Step 3 - calculate the integer alpha, the binary representation of
which is the vector H , and determine
e = alpha (mod q). (20)
If e = 0, then assign e = 1.
Step 4 - calculate the value v = e^(-1) (mod q) . (21)
Step 5 - calculate the values
z1 = s*v (mod q), z2 = -r*v (mod q). (22)
Step 6 - calculate the elliptic curve point C = z1*P + z2*Q and
determine
R = x_C (mod q), (23)
where x_C is x-coordinate of the point .
Step 7 - if the equality R = r holds, than the signature is accepted,
in the other case the signature is invalid.
The input data of the process are the signed message M, the digital
signature zeta and the verification key Q. The output result is the
witness of the signature validity or invalidity.
V.Dolmatov Expires May 10, 2010 [Page 12]

7. Test examples (Appendix to GOST R 34.10-2001)
This sectin is included in GOST R 34.10-2001 as an appendix but is
officially mentioned as not a part of the standard.
This is a reference appendix and is not a part of the standard. The
values given here for the parameters p, a, b, m, q, P, the signature
key d and the verification key Q are recommended only for testing
correctness of actual realizations of the algorithms described in
GOST R 34.10-2001.
All numerical values are introduced in decimal and hexadecimal
notations. The numbers beginning with 0x are in hexadecimal notation.
The symbol "\\" denotes a hyphenation of a number to the next line.
For example, the notation
12345\\
67890
0x499602D2
represents 1234567890 in decimal and hexadecimal number systems
correspondingly.
7.1 The digital signature scheme parameters
The following parameters must be used for the digital signature
generation and verification (see section 5.2).
7.1.1 Elliptic curve modulus
The following value is assigned to parameter p in this example
p= 57896044618658097711785492504343953926\\
634992332820282019728792003956564821041
p = 0x8000000000000000000000000000\\
000000000000000000000000000000000431
V.Dolmatov Expires May 10, 2010 [Page 13]